ImageMagick - Uninitialized Data Structure and Uninitialized Value Vulnerabilities
Summary
DLA-1139-1: imagemagick - security update. Affects imagemagick versions < 8:6.7.7.10-5+deb7u18. Fixed in 8:6.7.7.10-5+deb7u18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ImageMagick is an open-source software suite used for creating, editing, and converting raster images. It supports a wide range of image formats and provides various image manipulation functionalities. However, ImageMagick is susceptible to two vulnerabilities: an uninitialized data structure vulnerability (CVE-2017-15277) and an uninitialized value vulnerability (CVE-2017-15281).
Vulnerability Detail
The uninitialized data structure vulnerability (CVE-2017-15277) arises when ImageMagick attempts to read a specially crafted GIF file. Due to the uninitialized data structure, an attacker can exploit this vulnerability to disclose sensitive information. On the other hand, the uninitialized value vulnerability (CVE-2017-15281) occurs when ImageMagick processes a specially crafted PSD file. An uninitialized value used in a conditional jump can lead to a denial of service (application crash) or other unspecified impacts.
How To Fix
Minimum fixed version
8:6.7.7.10-5+deb7u18
This is the first release that contains the fix.
sudo apt-get install --only-upgrade imagemagickTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
ImageMagick is affected by two vulnerabilities: an uninitialized data structure vulnerability (CVE-2017-15277) and an uninitialized value vulnerability (CVE-2017-15281). To mitigate these vulnerabilities, it is crucial to upgrade your ImageMagick packages to version 8:6.7.7.10-5+deb7u18 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for imagemagick →
FAQ
ImageMagick is an open-source software suite used for creating, editing, and converting raster images. It provides various image manipulation functionalities and supports a wide range of image formats.
The uninitialized data structure vulnerability in ImageMagick can be exploited by an attacker to disclose sensitive information when a specially crafted GIF file is processed.
The uninitialized value vulnerability in ImageMagick can lead to a denial of service (application crash) or other unspecified impacts when processing a specially crafted PSD file.
To fix these vulnerabilities, it is recommended to upgrade your ImageMagick packages to version 8:6.7.7.10-5+deb7u18 or later. Follow the official Debian LTS security advisories and apply the necessary updates to your system.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for imagemagick.
